# GitHub Copilot Sandboxing GitHub Copilot Sandboxing is [[GitHub]]'s answer to the "agent with full shell access" problem: two complementary isolation modes for running [[GitHub Copilot CLI]] agent sessions. **Local sandboxing** (generally available since 2026-10-07) wraps the commands an agent runs on your machine in an OS-level sandbox powered by [[Microsoft eXecution Container (MXC)]]. **Cloud sandboxing** moves the whole session off your machine into an ephemeral, GitHub-hosted Linux environment built on Azure Container Apps Sandboxes; it is still in public preview. ## Update (October 2026): local sandboxing is GA Local sandboxing went generally available on 2026-10-07, in [[GitHub Copilot CLI]], the [[GitHub Copilot App]] and [[Visual Studio Code (VSCode)|VS Code]] sessions that run on Agent Host (the reference host behind the [[Agent Host Protocol (AHP)]]). Cloud sandboxing is still in public preview. Compared with the preview described below, the current docs show four changes: - **No more `--experimental` flag.** In the CLI, `/sandbox enable` turns it on and it stays on for future sessions (programmatic ones included) until you run `/sandbox disable`. In the app, project settings set the default for new local sessions, and you can switch it on an active one. The CLI and the app keep separate settings - **Windows support outside Insiders.** It needs Windows 11 25H2 with KB5124010, or 26H1 with KB5124006 (the BaseContainer tier of ProcessContainer). Linux needs bubblewrap 0.5.0+ and `slirp4netns`; macOS 15 is the tested baseline - **Credentials go through a local proxy.** Sandboxed commands get placeholder [[Git]] and `gh` tokens, and the proxy swaps in the real ones only for approved HTTPS hosts. You can mask other environment variables (API tokens, for instance) the same way - **Enterprises can require it outside the CLI too.** The `sandbox` key of [[GitHub Copilot Managed Settings]] now also covers VS Code (1.138+) and the app. Add `failIfUnavailable` and Copilot blocks model and tool execution when it can't enforce the sandbox, instead of running commands unsandboxed Still included in the seat at no extra cost, and the policy applies to tool execution whatever model Copilot uses. My take: GA is about support. The isolation model stayed the same. GitHub's own docs still put local sandboxing "at the lighter-weight end" of the spectrum (no VM, no container), and the in-process file tools below still honor the policy in software only. If you need a hard boundary, cloud sandboxing or [[Docker Sandboxes]] remain the stronger options. ## Local sandboxing Runs shell commands, built-in searches, and local MCP/LSP servers as sandboxed child processes, enforced by the OS via MXC's per-platform backends: Seatbelt on macOS, Bubblewrap on Linux, ProcessContainer on Windows. During the preview, Windows support required an Insiders build and you enabled it with `--experimental`; since GA, `/sandbox enable` turns it on (see the update above). The policy model is **deny-by-default** with automatic grants assembled per command: - The working directory gets read/write (default), the rest of a [[Git]] repository gets read-only - Tools on `PATH` (plus `GOPATH`, `CARGO_HOME`, `PYTHONPATH`) get read-only, so commands can't modify their own dependencies - System locations and the home directory get read-only; package manager caches get read/write - Network: outbound internet and local network are controlled independently - Credentials ([[Git]], `gh`), macOS keychain access, and per-command sandbox exceptions are all configurable - Overlaps resolve by specificity ("the more specific path wins"), and user config always beats automatic grants. Enterprise-managed settings ([[GitHub Copilot Managed Settings]]) compose in the most restrictive direction: the enterprise sets a floor users can tighten but never loosen Inspect with `/sandbox policy` and `/sandbox status`, configure with `/sandbox config`. **One big caveat**: the CLI's built-in file tools run in-process, and the CLI itself is not sandboxed, so the OS never sees those file operations. They honor the policy in software only, on a best-effort basis. Same class of caveat as MXC's own "not a security boundary yet" warning. ## Cloud sandboxing Each session runs in a fully isolated, ephemeral Linux VM on GitHub's infrastructure (`--cloud --experimental`). Sessions are snapshotted (files, environment variables, in-progress work) and can be resumed from any device. Also available when starting agent sessions from the [[GitHub Copilot App]]. Usage-billed (compute per second, memory per GiB-second, storage per GiB-month) versus local sandboxing which is included in the seat. Interactive sessions only; programmatic use is unsupported. Organizations must enable the Cloud Sandbox access policy. ## How it compares The sandboxing space splits by *where the boundary sits*: | Option | Boundary | Where it runs | Positioning | |--------|----------|---------------|-------------| | Copilot local sandboxing ([[Microsoft eXecution Container (MXC)|MXC]]) | OS process sandbox (Seatbelt/Bubblewrap/ProcessContainer) | Your machine | Policy on the agent's commands, lightest-weight isolation | | Copilot cloud sandboxing | Hosted ephemeral VM | GitHub cloud | Remove your machine from the blast radius entirely | | [[Docker Sandboxes]] | [[microVM]] per session (own kernel, private Docker daemon) | Your machine | VM-grade isolation locally, agent-agnostic (works with Copilot too) | | [[Windows Sandbox]] | [[Hyper-V]] container-VM hybrid | Your machine | Disposable full Windows desktop, not agent-specific; also an experimental MXC backend | | [[OpenSandbox]] | Pluggable runtimes (Docker, K8s, [[gVisor]], Kata, Firecracker) | Self-hosted | Open-source agent execution *platform*: lifecycle, credential vault, egress policy | | [[Cloudflare Sandbox SDK]] | [[Cloudflare Containers]] instance | Cloudflare edge | Managed sandbox-as-API for agents you build, addressable from Workers | | [[Vercel Sandboxes]] | [[microVM]] | Vercel cloud | Managed sandbox-as-API in the Vercel platform, secrets injected from outside | The key distinction: Copilot sandboxing secures *GitHub's own agent* for its users, while Docker Sandboxes secures *any local agent*, and OpenSandbox, Cloudflare, and Vercel are infrastructure for agents *you* build. And within Copilot itself: local sandboxing is a process-level policy (weaker, free, fast), cloud sandboxing is full machine isolation (stronger, billed, portable sessions). ## References - Concepts, cloud and local sandboxes: https://docs.github.com/en/copilot/concepts/about-cloud-and-local-sandboxes - Concepts, understanding local sandboxing: https://docs.github.com/en/copilot/concepts/agents/copilot-cli/understanding-local-sandboxing - How-to hub: https://docs.github.com/en/copilot/how-tos/cloud-and-local-sandboxes - Using local sandboxing: https://docs.github.com/en/copilot/how-tos/cloud-and-local-sandboxes/using-local-sandboxing - Configuring local sandbox settings: https://docs.github.com/en/copilot/how-tos/cloud-and-local-sandboxes/configuring-local-sandbox-settings - Enabling/disabling cloud sandboxes (org/enterprise): https://docs.github.com/en/copilot/how-tos/cloud-and-local-sandboxes/enabling-or-disabling-cloud-sandboxes-for-your-organization - Billing: https://docs.github.com/en/billing/concepts/product-billing/cloud-and-local-sandboxes - Public preview announcement: https://github.blog/changelog/2026-06-02-cloud-and-local-sandboxes-for-github-copilot-now-in-public-preview/ - Local sandboxing GA announcement (2026-10-07): https://github.blog/changelog/2026-10-07-local-sandboxing-for-github-copilot-now-generally-available/ - Enterprise managed settings, `sandbox` key: https://docs.github.com/en/copilot/reference/enterprise-administrators/enterprise-managed-settings - VS Code, sandboxing agent terminal commands: https://code.visualstudio.com/docs/agents/run/agent-sandboxing - MXC: https://github.com/microsoft/mxc ## Related - [[GitHub Copilot]] - [[GitHub Copilot CLI]] - [[GitHub Copilot App]] - [[Microsoft eXecution Container (MXC)]] - [[Docker Sandboxes]] - [[Windows Sandbox]] - [[OpenSandbox]] - [[Cloudflare Sandbox SDK]] - [[Vercel Sandboxes]] - [[Sandcastle (AI)]] - [[AI Agents]] - [[AI Agent Permissions]] - [[GitHub Copilot Managed Settings]] - [[Lethal Trifecta for AI Agents]] - [[Agent Host Protocol (AHP)]] - [[Visual Studio Code (VSCode)]] - [[microVM]]